Chinese-made Zbtlink routers have been found to ship with a backdoor that opens unauthenticated root shells, posing a significant security risk to users. This discovery highlights the importance of thorough security audits and the need for manufacturers to prioritize user data protection. The backdoor, dubbed ENDLESSDOORS, is a small tool called rctl, which was uploaded to GitHub in 2015 and never updated since. It runs as a userland process with root privileges, blending its true functionality with legitimate kworker processes. The implant automatically starts at boot and attempts to beacon to Chinese command-and-control infrastructure every 35 seconds. The vulnerability lies in the lack of handshake, negotiation, or authentication, allowing attackers to hijack the client/server communication and obtain a live root shell. This can be achieved by controlling the resolution of a specific domain or IP address, enabling remote control of the router without internet reachability. The affected router models include CPE2801, WE1026-5G-WD, WE1326, and many others, with firmware downloads temporarily taken down due to the security vulnerabilities. Users are advised to check for suspicious processes and block egress points to mitigate the risk. This incident underscores the critical need for manufacturers to prioritize security and transparency in their products, especially in the IoT space, where the consequences of a breach can be far-reaching and devastating.
